# Imports
import shap
import numpy as np
import time
import pandas as pd
from sklearn.preprocessing import LabelEncoder
from sklearn.model_selection import train_test_split
from sklearn.tree import DecisionTreeClassifier
from sklearn.ensemble import RandomForestClassifier
from sklearn.neural_network import MLPClassifier
shap.initjs()

Preprocess the Data

# Read data
data = pd.read_csv('Dataset-Unicauca-Version2-87Atts-Clean.csv')

# Rename Labels to DataFlow from previous processing that bucketed data usage
data.rename({"labels": "DataFlow"}, axis=1, inplace=True)

# Label Protocol Names to be used as targets for Random Forest Model
lb_make = LabelEncoder()
data["labels"] = lb_make.fit_transform(data["ProtocolName"])
data[["ProtocolName", "labels"]].head(11)
mapped_label_ids = dict(zip(lb_make.classes_,range(len(lb_make.classes_))))

# Drop columns not needed for modelling
data.drop(columns=["Flow.ID"], inplace=True)
data.drop(columns=["ProtocolName"], inplace=True)

# Split Data to train/test
y = data.iloc[:, -1]
data.drop(columns=data.columns[-1], axis=1, inplace=True)
X_train, X_test, y_train, y_test = train_test_split(data, y, test_size=0.2)

Setup Visualization Labels

# Prepare Interactive Predictive Label Selector for Visualizations
import ipywidgets as widgets
# Create the list of all labels for the drop down list
list_of_labels = y.unique().tolist()

# Create a list of tuples so that the index of the label is what is returned
tuple_of_labels = list(zip(list_of_labels, range(len(list_of_labels))))

# Create a widget for the labels and then display the widget
current_label = widgets.Dropdown(options=mapped_label_ids,
                              value=0,
                              description='Select Label:'
                              )
# Create a widget for the labels and then display the widget
current_label2 = widgets.Dropdown(options=mapped_label_ids,
                              value=0,
                              description='Select Label:'
                              )

# Function to report accuracy
def print_accuracy(f):
    print("Accuracy = {0}%".format(100 * np.sum(f(X_test) == y_test) / len(y_test)))
    time.sleep(0.5)  # to let the print get out before any progress bars

Create Simple Decision Tree Model

# Decision Tree Explainable
dtree = DecisionTreeClassifier(min_samples_split=20)
dtree.fit(X_train, y_train)
print_accuracy(dtree.predict)

Accuracy = 99.99692505520923%

Prepare SHAP Data that Explains the Decision Tree

shap_values = shap.TreeExplainer(dtree).shap_values(shap.sample(X_test, nsamples=1000))
shap_interaction_values = shap.TreeExplainer(dtree).shap_interaction_values(shap.sample(X_test, nsamples=1000))

# explain all the predictions in the test set
# Use shap.sample on X_train/test like the below because the dataset is too massive; just take a sample
explainer = shap.KernelExplainer(dtree.predict_proba, shap.sample(X_train, nsamples=1000))

Using 1000 background data samples could cause slower run times. Consider using shap.sample(data, K) or shap.kmeans(data, K) to summarize the background as K samples.

Violin Bee-Summary Plot

This is a standard violin plot but with outliers drawn as points. This gives a more accurate representation of the density out the outliers than a kernel density estimated from so few points. The color represents the average feature value at that position, so red regions have mostly high valued feature values while blue regions have mostly low feature values.

current_label

shap.summary_plot(shap_values = shap_values[current_label.value],
                  features = X_test.iloc[0:1000,:],
                  plot_type="violin")

By changing the label to something else we can see what features on the left have a higher impact on the model predicting this label. For example, when predicing the Protocol Name of "99TAXI" we see the feature L7Protocol has little importance on predicting this Protocol. However, the feature Forward Packet Length does.

Stacked Importance Plot

current_label

shap.force_plot(explainer.expected_value[0], shap_values[current_label.value], shap.sample(X_test, nsamples=1000), link='logit')

Visualization omitted, Javascript library not loaded!
Have you run `initjs()` in this notebook? If this notebook was from another user you must also trust this notebook (File -> Trust notebook). If you are viewing this notebook on github the Javascript has been stripped for security. If you are using JupyterLab this error is because a JupyterLab extension has not yet been written.

Again, by changing the predicted label to something else we can see what features are significant and not significant, like from the previous visualization. However, we cal also interact with different features and compairsons from an additional labels on the top and to the left of the visualization. We can see that when both the highlighted features equal a particular value what the other features we are comparing to on top may equal.

Dependent Correlation Plot

current_label

current_label2

shap.dependence_plot((current_label.value, current_label2.value), shap_interaction_values[current_label2.value], shap.sample(X_test, nsamples=1000))

This visualization can show the interactions between two different features. If the features were dependent on each other, there would be an inter-mingling of many colored points. Otherwise, the features are not correlated with each other.

Visualize a Single Prediction

# Prepare SHAP values
test1 = shap.TreeExplainer(dtree)
t = test1.shap_values(shap.sample(X_test, nsamples=1000))

# See all our predicted values from our X_test dataset.
test1.expected_value

array([3.49426033e-07, 2.43207507e-02, 2.13988502e-03, 3.35798418e-04,
       3.54317997e-04, 2.44598223e-06, 2.79540826e-06, 4.54253843e-06,
       1.01333550e-05, 4.11414211e-03, 5.24139049e-06, 2.41418446e-03,
       2.02667099e-05, 4.76617109e-04, 7.02905408e-03, 1.96726856e-04,
       3.32304157e-04, 2.55081004e-05, 8.13393919e-03, 6.63909462e-06,
       7.23311888e-05, 1.11760422e-02, 2.68258209e-01, 2.23632661e-04,
       4.54253843e-06, 1.90860343e-01, 8.87929986e-02, 1.38722135e-04,
       1.74277282e-01, 6.75091095e-04, 4.66134328e-04, 1.04827810e-06,
       4.89196446e-06, 1.74713016e-06, 2.09655620e-06, 1.52950763e-02,
       8.56093780e-05, 4.04845002e-03, 6.98852066e-06, 4.80810221e-04,
       4.45168766e-04, 3.49426033e-07, 3.73885855e-05, 1.65872538e-03,
       2.09655620e-06, 1.39770413e-06, 4.54253843e-06, 2.44598223e-06,
       6.98852066e-07, 1.04827810e-06, 2.44598223e-06, 1.39770413e-06,
       2.44598223e-06, 8.53193544e-03, 1.39770413e-06, 3.58161684e-04,
       2.69058045e-05, 1.13193418e-01, 2.42851093e-04, 1.04827810e-06,
       3.84368636e-06, 1.47457786e-04, 9.43450289e-06, 9.08507685e-06,
       7.82714313e-05, 6.28966859e-06, 5.09567984e-03, 6.95357805e-05,
       1.18804851e-05, 9.78392892e-06, 2.09655620e-05, 1.27156133e-03,
       2.09655620e-06, 5.76203528e-04, 9.62843433e-03, 5.93639887e-03,
       4.78095181e-02])

# View the features that predicted this label
print("Visualization for predicted label: " + str(int(test1.expected_value[0])))
shap.force_plot(test1.expected_value[0], shap_values[76], shap.sample(X_test, nsamples=1000))

Visualization for predicted label: 0

Visualization omitted, Javascript library not loaded!
Have you run `initjs()` in this notebook? If this notebook was from another user you must also trust this notebook (File -> Trust notebook). If you are viewing this notebook on github the Javascript has been stripped for security. If you are using JupyterLab this error is because a JupyterLab extension has not yet been written.

Now interact with the dropdowns at the top to select the feature and see the values of that feature that may predict the label above.